code-foundry 1.9.5 → 1.9.7

package/.github/workflows/validation_self-ci.yml

@@ -4,11 +4,7 @@ on:
   pull_request:
     branches: [main, staging]
     types:
-      - opened
-      - synchronize
-      - reopened
       - ready_for_review
-      - converted_to_draft
 
 # Default every caller job to no repository permissions. Individual jobs grant
 # only the scopes their own validation path consumes.
@@ -22,10 +18,9 @@ concurrency:
 jobs:
   mode:
     name: Mode
-    # Draft updates still create a lightweight skipped workflow record so a
-    # converted-to-draft event can cancel in-flight validation, but no runner
-    # or reusable validation workflow starts until the PR is ready for review.
-    if: vars.CI_BILLING_PAUSED != 'true' && github.event.pull_request.draft == false
+    # The workflow is emitted only for ready_for_review, so draft pull requests
+    # register no skipped validation checks and allocate no validation runner.
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ubuntu-slim
     timeout-minutes: 10
     permissions:
@@ -64,7 +59,7 @@ jobs:
   validation:
     name: Validation
     needs: mode
-    if: vars.CI_BILLING_PAUSED != 'true' && github.event.pull_request.draft == false
+    if: vars.CI_BILLING_PAUSED != 'true'
     # Reusable workflows can only maintain or reduce the caller job's scopes.
     # The audit tier needs security-events: write for CodeQL uploads.
     permissions:

package/AGENTS.md

@@ -71,11 +71,11 @@ Ask for clarification when a missing decision would materially change the implem
 8. Run the broadest applicable validation available.
 9. Report what changed, exact checks and results, skipped checks with reasons, risks, and remaining work.
 
-For normal feature work, branch from `staging` and target pull requests at `staging`. Treat `main` as the protected release branch. Follow `.github/CONTRIBUTING.md` for the complete internal and external contribution flow.
+For normal feature work, branch from `main` and target pull requests at `main`. Treat `main` as the protected release branch. Follow `.github/CONTRIBUTING.md` for the complete internal and external contribution flow.
 
 ## Git workflow and merging
 
-This repository uses the `staging-release` workflow: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Feature PRs land on `staging` with squash merges; promotion and release PRs land on `main` with rebase merges. Re-align `staging` with `main` after a release when needed.
+This repository uses the `direct` workflow: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Feature and release PRs land on `main` with squash merges. No integration branch exists; all pull requests target `main`.
 
 Merge only with the repository's canonical method. Never merge with `--admin`, never default or auto-select a merge method, and never use a method the branch ruleset does not allow. When in doubt, prefer the merge button's configured method and verify the ruleset after merging. Check `.github/CONTRIBUTING.md` for the complete flow and merge table.
 
@@ -149,7 +149,7 @@ If a check cannot run, state the exact reason. A skipped check is not a passing
 ## GitHub workflows and configuration
 
 - Keep workflows concise, independently runnable, and safe to re-run.
-- Use `push` for `main, staging` and `pull_request` for `staging` unless a workflow has a documented event-specific reason.
+- Use `push` for `main` and `pull_request` for `main` unless a workflow has a documented event-specific reason.
 - Give workflows clear names and jobs concise names; avoid repeating the workflow name in the job name.
 - Use per-workflow concurrency groups that cancel superseded runs while allowing independent workflows to run in parallel.
 - Keep setup language-aware and cache dependency downloads by lockfile; do not cache secrets, `node_modules`, virtual environments, or broad build output without a measured reason.

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [1.9.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.6...v1.9.7) (2026-09-08)
+
+
+### Bug Fixes
+
+* **ci:** run full validation on release PRs ([#517](https://github.com/0xPlayerOne/code-foundry/issues/517)) ([01a3555](https://github.com/0xPlayerOne/code-foundry/commit/01a355505d6372dc26e2d917e0e6d566ab25546c))
+* **sync:** remove direct topology staging residue ([#515](https://github.com/0xPlayerOne/code-foundry/issues/515)) ([2765e6a](https://github.com/0xPlayerOne/code-foundry/commit/2765e6a6f66137d37f3d65f8eb8311ba28eeafd7))
+
+## [1.9.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.5...v1.9.6) (2026-09-08)
+
+
+### Bug Fixes
+
+* **ci:** finalize direct fleet policy ([#513](https://github.com/0xPlayerOne/code-foundry/issues/513)) ([98c59a7](https://github.com/0xPlayerOne/code-foundry/commit/98c59a713f31d0bc5e3b9893434d89dba3257550))
+
 ## [1.9.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.4...v1.9.5) (2026-09-08)
 
 

package/README.md

@@ -75,9 +75,10 @@ The standard workflow triggers are:
 - Draft PR automation for supported feature/fix branches.
 
 Automated feature/fix and staging-promotion pull requests open as drafts.
-Pull-request validation waits until a PR is marked ready for review; later
-commits retrigger it, and converting the PR back to draft cancels in-flight
-validation. Scheduled and manually dispatched audits are unaffected.
+Pull-request validation runs on the ready-for-review transition. After later
+commits, convert the PR to draft and mark it ready again so checks attach to
+the current head. Converting a PR to draft runs only the lightweight
+cancellation control. Scheduled and manually dispatched audits are unaffected.
 
 Jobs are language-aware and skip irrelevant setup inside the applicable
 aggregate checks. TypeScript uses Oxlint, Oxfmt, and Bun's native
@@ -102,7 +103,8 @@ checks, runners, coverage, caching, and custom workflow extensions.
 
 The contribution policy defaults to the `direct` workflow: feature PRs squash
 into `main`, and Release Please version PRs use the configured
-`release_merge_strategy` (rebase by default, or squash when opted in).
+`release_merge_strategy` (squash for direct repositories; rebase for the
+optional staging-release topology).
 Repositories with a preview/staging environment opt into
 `git_workflow: staging-release`, where feature PRs squash into `staging`, the
 promotion PR rebases into `main` (`merge_strategy: rebase`), and Release Please

package/docs/CONFIGURATION.md

@@ -35,7 +35,7 @@ repository manifests and source
 | `languages`                | detected list                                                                    | TypeScript, Rust, Python, Solidity                                                                                  |
 | `package_manager`          | `bun`, `pnpm`, `yarn`, `npm`, `none`                                             | JavaScript setup                                                                                                    |
 | `toolchain`                | `auto`, `native`, `mise`                                                         | Environment setup policy; defaults to `auto`                                                                        |
-| `staging_validation_mode`  | `fast`, `audit`                                                                  | Validation tier for pull requests targeting `staging`; defaults to `fast`                                           |
+| `staging_validation_mode`  | `fast`, `audit`                                                                  | Staging-release-only validation tier; omitted from direct repositories                                              |
 | `performance`              | `auto`, `true`, `false`                                                          | Run a deterministic performance task when a supported entrypoint exists; defaults to `auto`                         |
 | `performance_command`      | JSON argv array or array of argv arrays                                          | One or more ordered commands for non-package harnesses; package scripts take precedence                             |
 | `performance_profile`      | empty, `node-package`                                                            | Optional shared package import, memory, archive, and dependency budget harness                                      |
@@ -53,8 +53,8 @@ repository manifests and source
 | `npm_publish`              | `true` or `false`                                                                | Opt into npm publication                                                                                            |
 | `license`                  | `gpl-3.0-or-later`, `agpl-3.0-or-later`, `apache-2.0`, `mit`, `preserve`, `none` | License policy; new repositories default to GPLv3                                                                   |
 | `git_workflow`             | `direct` (default), `staging-release`                                            | Branch/release model; `direct` opens feature branches into `main`, `staging-release` promotes `staging` into `main` |
-| `merge_strategy`           | `rebase`                                                                         | Promotion merge method for `staging` → `main`; only enforced by the `staging-release` topology                      |
-| `release_merge_strategy`   | `rebase`, `squash` (direct topology only)                                        | Merge method for Release Please version PRs into `main`; release automation fails closed on anything else           |
+| `merge_strategy`           | `squash` (direct), `rebase` (staging-release)                                    | Feature/promotion merge policy; direct repositories require squash                                                  |
+| `release_merge_strategy`   | `squash` (direct), `rebase` (staging-release)                                    | Merge method for Release Please version PRs into `main`; release automation fails closed on anything else           |
 | `runner` fields            | GitHub runner names                                                              | Per-workflow runner policy, including `performance_runner`                                                          |
 
 Supported features are `ci`, `codeql`, `security`, `test`, `draft-pr`,
@@ -113,14 +113,13 @@ checks should remain separate from this deterministic validation task.
 
 ## OpenCode Security opt-in and opt-out
 
-`opencode_security` controls the optional OpenCode scan, and the generated
-caller ships in every repository. The `OPENCODE_SECURITY` repository variable
-overrides the configuration at run time, so a scan can be toggled on any
-repository without a configuration change or a new secret:
+The generated OpenCode caller ships in every repository. The
+`OPENCODE_SECURITY` repository or organization variable is its only enablement
+control, so a scan can be toggled without a code change:
 
 - `OPENCODE_SECURITY: true` opts the repository in.
 - `OPENCODE_SECURITY: false` opts the repository out.
-- unset falls back to the `opencode_security` configuration (default `false`).
+- unset is disabled.
 
 The scan only runs when it is enabled and the `OPENCODE_API_KEY` secret is
 present.
@@ -131,8 +130,8 @@ present.
 
 - `direct` (default): feature branches open pull requests directly into
   `main`. Validation and security scans run on every PR. No `staging` branch
-  exists, no promotion caller is generated, and `merge_strategy` is not
-  enforced. Release Please version PRs squash into `main`
+  exists, no promotion caller is generated, and `merge_strategy` must be
+  `squash`. Release Please version PRs squash into `main`
   (`release_merge_strategy: squash`). Dependabot updates target `main`. This is
   the right choice when a repository has no preview or staging environment.
 - `staging-release` (opt-in): feature branches squash into `staging`, a
@@ -181,4 +180,7 @@ Vercel's integration) by adding a small caller for the runtime's reusable
 for pull-request previews and `wrangler deploy` for production, records a
 GitHub deployment plus status with the workers.dev URL, and respects
 `CI_BILLING_PAUSED`. It requires the `CLOUDFLARE_API_TOKEN` and
-`CLOUDFLARE_ACCOUNT_ID` secrets in the consumer repository.
+`CLOUDFLARE_ACCOUNT_ID` secrets in the consumer repository. Bun consumers may
+also pass `build-script`, `install-working-directory`, and `bun-version`; the
+runtime installs the frozen lockfile and builds the Worker before invoking
+Wrangler.

package/docs/RELEASES.md

@@ -27,7 +27,7 @@ rebase`), and Release Please version PRs merge with **rebase**
 branches squash straight into `main` and Release Please version PRs squash into
 `main` (`release_merge_strategy: squash`). `merge_strategy` is not enforced. Release automation never defaults
 to a merge method and never merges with `--admin`: `staging-release` accepts
-only rebase for release PRs, while `direct` accepts rebase or squash.
+only rebase for release PRs, while `direct` requires squash.
 
 The release workflow opens or updates a versioned PR after changes reach
 `main`. Merging that PR updates the changelog, creates the Git tag and GitHub
@@ -54,7 +54,7 @@ selected, `merge_strategy` applies to promotion PRs (`staging` into `main`)
 and `release_merge_strategy` to Release Please version PRs; feature PRs into
 `staging` use squash merges. `code-foundry doctor`, `code-foundry sync`, and
 the release workflow reject any non-`rebase` `merge_strategy` or release
-strategy in `staging-release`; `direct` accepts `rebase` or `squash` for
+strategy in `staging-release`; `direct` requires `squash` for
 release PRs and never falls back to `merge`. Both keep `main` fully linear,
 which is what makes the post-release reconciliation possible. The final
 branch trees are inspected before mutation; validated main-only changes are

package/docs/WORKFLOWS.md

@@ -12,10 +12,12 @@ pull_request:
   # direct topology: branches: [main]
 ```
 
-The generated caller suppresses runner and reusable-workflow jobs while the
-pull request is a draft. It listens for `ready_for_review` to start validation,
-for later `synchronize` events to rerun it, and for `converted_to_draft` to
-cancel in-flight validation through the caller's concurrency group.
+The generated validation caller listens only for `ready_for_review`, so draft
+pull requests register no validation checks and allocate no validation runner.
+After any later update, convert the pull request to draft and mark it ready
+again so required checks attach to the current head. A separate lightweight
+draft-control caller listens for `converted_to_draft` and cancels queued or
+running pull-request workflows without creating skipped validation jobs.
 
 The separate `validation-audit.yml` caller is pinned to the configured released
 runtime and handles scheduled and manual audits:
@@ -39,7 +41,7 @@ opens those PRs as drafts. Promotion automation listens to `staging` pushes
 (staging-release only) and also always opens its PR as a draft. Release
 automation listens to `main` pushes.
 Custom deployment, indexing, search, Slither, or other workflows are
-repository-owned extensions and should keep their own triggers and permissions.
+repository-owned extensions and should use the same ready-transition policy.
 
 ## Billing pause
 
@@ -83,9 +85,9 @@ throughout the bounded release flow.
 Custom workflows are repository-owned and are not rewritten by sync. Add
 `if: vars.CI_BILLING_PAUSED != 'true'` to each custom root job that should
 honor the shared billing pause. The optional OpenCode Security scan honors a
-second toggle: the `OPENCODE_SECURITY` repository variable (`true`/`false`)
-overrides the `opencode_security` configuration per run, so individual
-repositories can opt in or out without a code change.
+second toggle: the `OPENCODE_SECURITY` repository or organization variable
+(`true`/`false`) is its only enablement control, so individual repositories can
+opt in or out without a code change.
 
 ## Standard workflow responsibilities
 
@@ -114,20 +116,20 @@ succeeds.
 
 The merge audit pins one merge method per transition. `code-foundry doctor`
 and `code-foundry sync` validate release strategy against the repository
-topology. Staging-release release PRs require `rebase`; direct release PRs
-allow `rebase` or `squash`. The release workflow fails closed on any other
-strategy and never falls back to `merge`.
+topology. Direct feature and release PRs require `squash`; staging-release
+promotion and release PRs require `rebase`. The release workflow fails closed
+on any other strategy and never falls back to `merge`.
 
-| Transition                                                 | Merge method                                                              | Enforcement                                                                                                                                                                |
-| ---------------------------------------------------------- | ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Feature/fix PR into `main` (direct topology)               | Squash                                                                    | Contribution policy; see `CONTRIBUTING.md`                                                                                                                                 |
-| Feature/fix PR into `staging` (staging-release topology)   | Squash                                                                    | Contribution policy; see `CONTRIBUTING.md`                                                                                                                                 |
-| `staging` → `main` promotion PR (staging-release topology) | Rebase (`merge_strategy: rebase`)                                         | Code Foundry creates a one-commit head with `main` as its parent and the exact validated `staging` tree; `merge_strategy` must be `rebase`, and merge commits are rejected |
-| Release Please version PR into `main`                      | Configured (`release_merge_strategy`: rebase default; squash direct only) | Release automation fails closed on unsupported topology/strategy; never defaults to `merge`, never uses `--admin`                                                          |
+| Transition                                                 | Merge method                                | Enforcement                                                                                                                                                                |
+| ---------------------------------------------------------- | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Feature/fix PR into `main` (direct topology)               | Squash                                      | Contribution policy; see `CONTRIBUTING.md`                                                                                                                                 |
+| Feature/fix PR into `staging` (staging-release topology)   | Squash                                      | Contribution policy; see `CONTRIBUTING.md`                                                                                                                                 |
+| `staging` → `main` promotion PR (staging-release topology) | Rebase (`merge_strategy: rebase`)           | Code Foundry creates a one-commit head with `main` as its parent and the exact validated `staging` tree; `merge_strategy` must be `rebase`, and merge commits are rejected |
+| Release Please version PR into `main`                      | Squash (direct) or rebase (staging-release) | Release automation fails closed on unsupported topology/strategy; never defaults to `merge`, never uses `--admin`                                                          |
 
 The promotion rows above apply only to `staging-release`; `direct`
-repositories never generate a promotion caller and `merge_strategy` is not
-enforced for them.
+repositories never generate a promotion caller and require `merge_strategy:
+squash` for feature pull requests.
 
 Release auto-merge waits for required checks and then polls `mergeStateStatus`
 until it is `CLEAN`, or `UNSTABLE` with `mergeable` `MERGEABLE`, before
@@ -139,7 +141,7 @@ merge policy-blocked. The mergeability poll is bounded and fails closed on
 conflicts or timeout; releases without an automation token remain manual.
 
 Keeping `main` linear — rebase promotions and release PRs in the
-`staging-release` topology, or a single-commit rebase/squash release PR in the
+`staging-release` topology, or a single-commit squash release PR in the
 `direct` topology — is what lets the post-release reconciliation fast-forward
 or replay `staging` safely. `direct` repositories have no reconciliation step:
 releases merge straight into `main` with the configured
@@ -147,7 +149,7 @@ releases merge straight into `main` with the configured
 
 Protect `main` with the aggregate `Validation / Gate`. Require squash for
 feature/fix pull requests and permit the configured Release Please method:
-rebase in `staging-release`, or rebase/squash in `direct`. In the
+rebase in `staging-release`, or squash in `direct`. In the
 `staging-release` topology, protect `staging` the same way with a single GitHub
 Actions integration path. That path uses the
 GitHub Actions integration token by default, and optionally an SSH deploy key

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.9.5",
+  "version": "1.9.7",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/doctor.mjs

@@ -116,30 +116,45 @@ export function doctor(root, options = {}) {
     error(`unsupported git_workflow: ${workflow}; use direct or staging-release`)
   }
   const mergeStrategy = config.merge_strategy ?? 'rebase'
+  if (workflow === 'direct' && mergeStrategy !== 'squash') {
+    error(
+      `merge_strategy must be "squash" for direct feature pull requests; got "${mergeStrategy}".`
+    )
+  }
   if (workflow === 'staging-release' && mergeStrategy !== 'rebase') {
     error(
       `merge_strategy must be "rebase" for the staging-release promotion topology; got "${mergeStrategy}".`
     )
   }
   const releaseMergeStrategy = config.release_merge_strategy ?? ''
-  const allowedReleaseStrategies =
-    workflow === 'staging-release' ? ['rebase'] : ['rebase', 'squash']
+  const allowedReleaseStrategies = workflow === 'staging-release' ? ['rebase'] : ['squash']
   if (
     includesValue(features, 'release') &&
     !allowedReleaseStrategies.includes(releaseMergeStrategy)
   ) {
     error(
-      `release_merge_strategy must be "rebase"${workflow === 'staging-release' ? '' : ' or "squash" (direct topology)'} for automated release merges; got "${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}".`
+      `release_merge_strategy must be "${workflow === 'staging-release' ? 'rebase' : 'squash'}" for automated release merges; got "${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}".`
     )
   }
-  for (const name of ['validation', 'draft-pr', 'release-pr', 'release']) {
-    if (name === 'release-pr' && workflow !== 'staging-release') continue
-    if (includesValue(features, name) && !existsSync(join(target, `.github/workflows/${name}.yml`)))
-      error(`missing enabled workflow: ${name}.yml`)
-  }
+  if ('opencode_security' in config)
+    error('opencode_security is obsolete; use the OPENCODE_SECURITY repository variable.')
+  if (workflow === 'direct' && 'staging_validation_mode' in config)
+    error(
+      'staging_validation_mode is not valid in a direct-topology repository; run sync to prune it.'
+    )
   const validationEnabled =
     includesValue(features, 'validation') ||
     ['ci', 'test', 'security', 'codeql'].some((legacy) => includesValue(features, legacy))
+  for (const name of ['validation', 'draft-control', 'draft-pr', 'release-pr', 'release']) {
+    if (name === 'release-pr' && workflow !== 'staging-release') continue
+    const enabled = name === 'draft-control' ? validationEnabled : includesValue(features, name)
+    const candidates = [
+      join(target, `.github/workflows/${name}.yml`),
+      join(target, `.github/workflows/${name}_self-ci.yml`),
+    ]
+    if (enabled && !candidates.some((file) => existsSync(file)))
+      error(`missing enabled workflow: ${name}.yml`)
+  }
   const validationCaller = ['validation.yml', 'validation_self-ci.yml']
     .map((file) => join(target, `.github/workflows/${file}`))
     .find((file) => existsSync(file) && /pull_request:/.test(readFileSync(file, 'utf8')))
@@ -152,6 +167,12 @@ export function doctor(root, options = {}) {
         'validation caller is missing the Validation job; the Validation / Gate aggregate check cannot form.'
       )
     }
+    if (!/types:\n\s+- ready_for_review/.test(caller)) {
+      error('validation caller must wait for the ready_for_review transition.')
+    }
+    if (/\s+- (?:opened|synchronize|reopened|converted_to_draft)\s*$/.test(caller)) {
+      error('validation caller registers draft-time checks; run code-foundry sync.')
+    }
     if (
       !/uses:\s+(?:\.\/\.github\/workflows\/validation(?:-no-codeql)?\.yml|\S+\/\.github\/workflows\/validation(?:-no-codeql)?\.yml@)/.test(
         caller

package/src/commands/sync.mjs

@@ -43,6 +43,7 @@ const standardFiles = [
   '.github/ISSUE_TEMPLATE/feature_request.yml',
   '.github/workflows/validation.yml',
   '.github/workflows/validation-audit.yml',
+  '.github/workflows/draft-control.yml',
   '.github/workflows/draft-pr.yml',
   '.github/workflows/release-pr.yml',
   '.github/workflows/release.yml',
@@ -117,6 +118,15 @@ export function syncRepository(options) {
     throw new Error('Missing .github/code-foundry.yml; run init first.')
   const defaults = createDefaultConfig(target, source, existingConfig.git_workflow)
   let config = { ...defaults, ...existingConfig }
+  const workflow = gitWorkflow(config.git_workflow)
+  if (!['direct', 'staging-release'].includes(workflow)) {
+    throw new Error(`Unsupported git_workflow: ${workflow}; use direct or staging-release.`)
+  }
+  const obsoleteConfigKeys = [
+    'opencode_security',
+    ...(workflow === 'direct' ? ['staging_validation_mode'] : []),
+  ]
+  for (const key of obsoleteConfigKeys) delete config[key]
   // Resolve and validate the license policy before any sync writes occur
   // (including config/default additions) so an unsupported policy fails
   // fast without leaving partially generated files behind.
@@ -133,10 +143,11 @@ export function syncRepository(options) {
     writeOrReport(configPath, renderConfig(config), dryRun)
   } else {
     const missing = Object.keys(defaults).filter((key) => !(key in existingConfig))
-    if (missing.length) {
-      const current = readFileSync(configPath, 'utf8').trimEnd()
+    const original = readFileSync(configPath, 'utf8')
+    const normalized = removeConfigKeys(original, obsoleteConfigKeys).trimEnd()
+    if (missing.length || normalized !== original.trimEnd()) {
       const additions = missing.map((key) => renderConfigLine(key, defaults[key])).join('\n')
-      writeOrReport(configPath, `${current}\n${additions}\n`, dryRun)
+      writeOrReport(configPath, `${normalized}${additions ? `\n${additions}` : ''}\n`, dryRun)
     }
   }
 
@@ -155,17 +166,18 @@ export function syncRepository(options) {
   if (!['auto', 'native', 'mise'].includes(toolchain)) {
     throw new Error(`Unsupported toolchain: ${toolchain}; use auto, native, or mise.`)
   }
-  const workflow = gitWorkflow(config.git_workflow)
-  if (!['direct', 'staging-release'].includes(workflow)) {
-    throw new Error(`Unsupported git_workflow: ${workflow}; use direct or staging-release.`)
-  }
   const stagingValidationMode = configured(config.staging_validation_mode, 'fast')
-  if (!['fast', 'audit'].includes(stagingValidationMode)) {
+  if (workflow === 'staging-release' && !['fast', 'audit'].includes(stagingValidationMode)) {
     throw new Error(
       `Unsupported staging_validation_mode: ${stagingValidationMode}; use fast or audit.`
     )
   }
   const mergeStrategy = configured(config.merge_strategy, 'rebase')
+  if (workflow === 'direct' && mergeStrategy !== 'squash') {
+    throw new Error(
+      `Unsupported merge_strategy: ${mergeStrategy}; the direct topology requires squash for feature pull requests.`
+    )
+  }
   if (workflow === 'staging-release' && mergeStrategy !== 'rebase') {
     throw new Error(
       `Unsupported merge_strategy: ${mergeStrategy}; the staging-release topology requires rebase for staging to main promotions.`
@@ -177,11 +189,10 @@ export function syncRepository(options) {
     // release commits; the direct topology has no reconciliation step, so it
     // may also squash Release Please version PRs (a single-commit release PR
     // squashes to the identical tree, and release-please recommends squash).
-    const allowedReleaseStrategies =
-      workflow === 'staging-release' ? ['rebase'] : ['rebase', 'squash']
+    const allowedReleaseStrategies = workflow === 'staging-release' ? ['rebase'] : ['squash']
     if (!allowedReleaseStrategies.includes(releaseMergeStrategy)) {
       throw new Error(
-        `Unsupported release_merge_strategy: ${releaseMergeStrategy || '(unset)'}; release automation requires rebase (or squash in the direct topology) for Release Please version pull requests and never defaults to merge.`
+        `Unsupported release_merge_strategy: ${releaseMergeStrategy || '(unset)'}; release automation requires ${workflow === 'staging-release' ? 'rebase' : 'squash'} for Release Please version pull requests and never defaults to merge.`
       )
     }
   }
@@ -459,6 +470,7 @@ function shouldInclude(file, languages, features, config) {
   // the configuration or the variable enables it and the API key exists.
   if (file === '.github/workflows/opencode-security.yml') return true
   const workflow = file.match(/^\.github\/workflows\/([^/]+)\.yml$/)?.[1]
+  if (workflow === 'draft-control') return true
   // The staging promotion caller only exists in the staging-release topology;
   // direct repositories open feature branches into main and need no promotion.
   if (workflow === 'release-pr' && !isStagingRelease(config.git_workflow)) return false
@@ -539,6 +551,21 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
   // target main, so their callers trigger on main alone.
   if (!isStagingRelease(config.git_workflow)) {
     rendered = rendered.replace(/^(\s+branches:)\s*\[main,\s*staging\]\s*$/gm, `$1 [main]`)
+    // Direct repositories have no staging branch or release reconciliation,
+    // so their generated release caller must not expose the legacy deploy-key
+    // secret. Keep it in the staging-release template for repositories that
+    // still explicitly select that topology.
+    if (workflow === 'release') {
+      rendered = rendered.replace(
+        /^\s+STAGING_DEPLOY_KEY:\s+\$\{\{\s*secrets\.STAGING_DEPLOY_KEY\s*\}\}\s*\n/m,
+        ''
+      )
+    }
+  } else if (workflow === 'release' && !rendered.includes('STAGING_DEPLOY_KEY')) {
+    rendered = rendered.replace(
+      /^(\s+)CODE_FOUNDRY_TOKEN:\s+\$\{\{\s*secrets\.CODE_FOUNDRY_TOKEN\s*\}\}\s*$/m,
+      '$&\n$1STAGING_DEPLOY_KEY: ${{ secrets.STAGING_DEPLOY_KEY }}'
+    )
   }
   if (workflow === 'draft-pr') {
     // The draft PR caller states the PR base explicitly so the shared
@@ -645,21 +672,26 @@ function stripDependabotEcosystem(content, ecosystem) {
  * @returns {string}
  */
 export function renderContributionDocs(content, file, config) {
-  if (isStagingRelease(config.git_workflow)) {
-    if (configured(config.staging_validation_mode, 'fast') !== 'audit') return content
-    return content.replace(
-      'Fast validation: CI plus unit tests, ending in `Validation / Gate`',
-      'Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`'
-    )
-  }
   const replacements = DIRECT_DOC_REPLACEMENTS[file]
   if (!replacements) return content
   let rendered = content
-  for (const [from, to] of replacements) {
-    if (!rendered.includes(from)) {
-      throw new Error(`Missing direct-workflow template marker in ${file}: ${JSON.stringify(from)}`)
+  const stagingRelease = isStagingRelease(config.git_workflow)
+  for (const [staging, direct] of replacements) {
+    const from = stagingRelease ? direct : staging
+    const to = stagingRelease ? staging : direct
+    if (rendered.includes(from)) {
+      rendered = rendered.replace(from, to)
+    } else if (!rendered.includes(to)) {
+      throw new Error(
+        `Missing ${stagingRelease ? 'staging-release' : 'direct'} workflow template marker in ${file}: ${JSON.stringify(from)}`
+      )
     }
-    rendered = rendered.replace(from, to)
+  }
+  if (stagingRelease && configured(config.staging_validation_mode, 'fast') === 'audit') {
+    rendered = rendered.replace(
+      'Fast validation: CI plus unit tests, ending in `Validation / Gate`',
+      'Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`'
+    )
   }
   return rendered
 }
@@ -695,7 +727,7 @@ const DIRECT_DOC_REPLACEMENTS = {
     ],
     [
       'The Git workflow is `staging-release`: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other merge strategy. Re-align `staging` with `main` after a release when needed.',
-      'The Git workflow is `direct`: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other release merge strategy. Feature branches never touch `staging`; repositories with a preview/staging environment opt into `git_workflow: staging-release` explicitly.',
+      'The Git workflow is `direct`: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other release merge strategy. This repository has one protected integration and release branch: `main`.',
     ],
     [
       'git switch staging\ngit pull --ff-only origin staging',
@@ -717,11 +749,15 @@ const DIRECT_DOC_REPLACEMENTS = {
     ],
     [
       '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Release-policy validation only, ending in `Validation / Gate`                         |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |\n| Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |\n',
-      '| Event | Expected automation |\n|------------------------------------------------------------------------------------------------------------------------------------------------|\n| Draft pull request targeting `main` | No runner-heavy validation; run local checks before requesting review |\n| Ready pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Release-policy validation only, ending in `Validation / Gate` |\n| Scheduled or manual validation | Full audit tier |\n| Push to a working branch | Draft PR workflow |\n| Push to `main` | Release workflow; canonical validation already ran on the merged PR |',
+      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Release-policy validation only, ending in `Validation / Gate`                         |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |\n',
     ],
     [
       '| Change                       | Target    | Merge method                                    | Merge gate                                                |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |\n| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |\n| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |\n',
-      '| Change | Target | Merge method | Merge gate |\n|----------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Working branch | `main` | Squash | All applicable required checks pass |\n| Release Please version PR | `main` | Squash (`release_merge_strategy`) | Validation gate and release policy pass |',
+      '| Change                    | Target | Merge method                      | Merge gate                              |\n| ------------------------- | ------ | --------------------------------- | --------------------------------------- |\n| Working branch            | `main` | Squash                            | All applicable required checks pass     |\n| Release Please version PR | `main` | Squash (`release_merge_strategy`) | Validation gate and release policy pass |\n',
+    ],
+    [
+      'Draft pull requests do not start runner-heavy validation. Marking a pull request ready for review starts the applicable validation tier; converting it back to draft cancels in-flight validation, and no replacement starts until it is ready again.',
+      'Draft pull requests do not start validation. Marking a pull request ready for review starts the applicable validation tier. Convert it back to draft after an update, then mark it ready again after every update so the required checks attach to the current head. Converting it to draft runs only the lightweight cancellation control.',
     ],
     ['1. Create a focused branch from `staging`.', '1. Create a focused branch from `main`.'],
   ],
@@ -1149,7 +1185,7 @@ function createDefaultConfig(root, source, configuredWorkflow) {
     runtime_ref: `v${readPackageVersion(source)}`,
     ...runners,
     toolchain: 'auto',
-    staging_validation_mode: 'fast',
+    ...(stagingRelease ? { staging_validation_mode: 'fast' } : {}),
     performance: 'auto',
     performance_command: '',
     performance_profile: '',
@@ -1164,7 +1200,6 @@ function createDefaultConfig(root, source, configuredWorkflow) {
     post_release: 'false',
     post_release_workflow: '',
     post_release_mode: 'auto',
-    opencode_security: 'false',
     opencode_security_model: '',
     sync_mode: 'overlay',
     custom_workflows: 'preserve',
@@ -1181,6 +1216,20 @@ function renderConfig(config) {
     .map(([key, value]) => renderConfigLine(key, value))
     .join('\n')}\n`
 }
+
+/** @param {string} content @param {string[]} keys */
+function removeConfigKeys(content, keys) {
+  if (!keys.length) return content
+  const rejected = new Set(keys)
+  return content
+    .split(/\r?\n/)
+    .filter((line) => {
+      const key = line.match(/^([A-Za-z0-9_-]+):/)?.[1]
+      return !key || !rejected.has(key)
+    })
+    .join('\n')
+}
+
 /** @param {string} key @param {string} value */
 function renderConfigLine(key, value) {
   if (value === '') return `${key}:`